A critical business logic vulnerability in the SourceCodester Pharmacy Product Management System 1.0 allows attackers to corrupt inventory data via unauthenticated input manipulation.

The application fails to perform proper input validation on the txtqty parameter within the add-stock.php file. This flaw allows an unauthenticated attacker to supply negative values, causing the system to decrement stock levels instead of incrementing them.

The ability to manipulate stock records directly results in inventory data corruption, which can disrupt pharmacy operations and supply chain integrity. Given the CVSS score of 7.5, this vulnerability represents a significant risk to service availability and operational accuracy, potentially leading to a complete Denial of Service for the inventory management module.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the add-stock.php endpoint to authorized internal network segments only.

Proactive Monitoring: Monitor system logs for anomalous activity involving the add-stock.php file, specifically looking for unusual HTTP requests containing negative integer inputs.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect the txtqty parameter and block any requests containing negative numeric values.

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher's write-up referenced in the CVE record.

This vulnerability poses a clear risk to data integrity and operational continuity. Due to the lack of a formal vendor patch, organizations currently using this software must immediately implement strict network access controls or WAF filtering to prevent unauthorized manipulation of inventory records. Continuous monitoring for exploitation attempts is essential until a permanent code-level fix can be applied.